high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | February 2006 (4.02) |
| Protection available since | 26 December 2005 14:39:37 (GMT) |
| Last updated | 4 January 2006 13:51:39 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please contact technical support.
More Information
W32/Brontok-H is a worm for the Windows platform.
When first run W32/Brontok-H copies itself to:
<User>\Local Settings\Application Data\GavGent.B
<User>\Local Settings\Application Data\IDTemplate.exe
<User>\Local Settings\Application Data\csrss.exe
<User>\Local Settings\Application Data\inetinfo.exe
<User>\Local Settings\Application Data\lsass.exe
<User>\Local Settings\Application Data\services.exe
<Startup>\Empty.pif
<Windows>\pif\cvt.exe
The following registry entries are created to run IDTemplate.exe and cvt.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
IDTemplates
<User>\Local Settings\Application Data\IDTemplate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SystemGent
<Windows>\PIF\CVT.exe
The following registry entry is set, disabling the registry editor (regedit):
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableCMD
0
|
